Information pursuant to Art. 13 of Regulation (EU) 2016/679 - WEB​

version n.1 del 25-02-2025

The Data Controller, as defined below, hereby (“Information Notice”) wishes to inform you of the purposes and means of the processing of your personal data and of your rights under Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“GDPR”). This Notice may be supplemented by the Data Controller where any additional services you request involve further processing.

Data controller

GreenTek Hub Srl based in Via del Battirame 6/3 40138 Bologna (Bologna), Italy; Email: [email protected]; P.IVA / CF: 02234540561;

Data Protection Officer / DPO

WRP srl

Types of data processed

The processing activities carried out are aimed at acquiring the following personal data:

• Behavioral data: Navigation logs;
• Common data: Master data;
• Economic Data: Banking.

Stakeholder categories

The processing activities carried out are aimed at the following categories of data subjects: Web Users/Customers

Purpose of processing and condition that makes processing lawful

1. CUSTOMERS - Contract Execution

The processing of personal data is necessary for the acquisition of information necessary for the conclusion and execution of the contract concluded with the Data Controller concerning the sale of fuel and air filtration products.

Condition of Lawfulness Processing: Execution Contract - Art. 6, c.1, let. b. GDPR

Purposes of the processing: 1) Execution and management of the contract entered into with the Data Controller; 2) Acquisition of information prior to the conclusion of contracts; 3) Communications transmitted and/or received to/from customers related to the execution and/or conclusion of the contract, carried out through various means of communication such as telephone, email (electronic mail), instant messaging, paper mail.

Nature of conferral:

Mandatory - Failure to provide data will result in the Data Controller being unable to execute the contract.

Personal data retention period:

Personal data, for the execution of the contract, will be processed for the time necessary to manage the existing relationship with the Data Controller. The information collected for the evaluation of the conclusion of the contract, in case of failure, will be deleted within 6 months.

Mode of Treatment:

The processing is carried out, predominantly, by computer tools.

2. CUSTOMERS - Legal Compliance

The processing of personal data is necessary for the fulfillment of obligations required by laws, regulations and/or EU regulations, supervisory/control bodies or other authorities empowered to do so.

Condition of Lawfulness Processing: Legal Obligation - Art. 6, c.1, let. c. GDPR

Purpose of processing: 1) Storage of accounting and administrative documents in paper form; 2) Storage of accounting and administrative documents in digital form; 3) Digital storage of issued/received invoices (electronic invoicing).

Nature of conferral:

Mandatory - Failure to provide data will result in the Data Controller being unable to execute the contract.

Personal data retention period:

Personal data will be processed for this purpose for as long as necessary for the fulfillment of legal obligations under current legislation. In this regard, personal data will be retained for 10 years from the termination of the contract or from a binding decision issued by a competent authority, whichever is later. This is without prejudice, however, to any retention obligations relating to particular categories of data, for longer periods of time, prescribed by the legal system.

Mode of Treatment:

The processing is carried out, predominantly, by computer tools.

3. CUSTOMERS - Marketing

Transmission of business proposals promoted by the Data Controller.

Condition of Lawfulness of Processing: Consent - Art. 6, c.1, let. a. GDPR

Purposes of processing: 1) Transmission of commercial newsletters to the e-mail addresses of customers and/or potential customers; 2) Transmission of instant messages through tools such as SMS, Whatsapp, Telegram; 3) Transmission of messages through paper and electronic tools (email).

Nature of conferral:

Optional - Failure to provide data will result in the data subject being unable to receive messages regarding promotions offered by the Data Controller.

Personal data retention period:

Deleted data will be deleted immediately upon termination of the contract or revocation of consent. Prospect data, for which the contract will not be finalized, will be deleted within 24 months after registration.

Mode of Treatment:

The processing is carried out, predominantly, by computer tools.

4. WEBSITE - Data Navigation

To derive anonymous statistical information on usage, check the proper functioning of the site, ascertain responsibility in case of hypothetical computer crimes against the Owner.

Condition of Lawfulness of Processing: Legitimate Interest - Art. 6, c.1, let. f. GDPR

Purposes of processing: 1) Analysis of data to perform the evolution and maintenance of the website; 2) Investigation of liability in case of potential computer crimes to the detriment of the website and/or Data Subjects; 3) Anonymous statistical analysis, on the use of the website.

Nature of conferral:

Mandatory - Failure to provide data will result in the inability of the company to deliver the web service provided.

Personal data retention period:

Data are kept for 30 days.

Mode of Treatment:

Processing is carried out with computer tools.

5. WEBSITE - Requests from the Site

Requests made by data subjects through the Data Controller's website.

Condition of Lawfulness Processing: Execution Contract - Art. 6, c.1, let. b. GDPR

Purposes of processing: 1) Sending requests via web platform tools.

Nature of conferral:

Optional - Failure to provide the data will make it impossible for the Data Controller to respond to the data subject's requests.

Personal data retention period:

Request processing.

Mode of Treatment:

Processing is carried out with computer tools.

6. WEBSITE - Use of Service and Restricted Area

Making use of the services offered through the restricted area of the Owner's site.

Condition of Lawfulness Processing: Execution Contract - Art. 6, c.1, let. b. GDPR

Purposes of processing: 1) Registration within the restricted area; 2) Use of the service provided by accessing the restricted area of the site.

Nature of conferral:

Optional - Failure to provide data will make it impossible for the Data Controller to provide services through the restricted area of the site.

Personal data retention period:

User deletion.

Mode of Treatment:

Processing is carried out with computer tools.

7. IT systems management

Personal data are used, for the legitimate interest of the Owner and the Data Subjects, for the management and security of the technological (IT) infrastructure.

Condition of Lawfulness of Processing: Legitimate Interest - Art. 6, c.1, let. f. GDPR

Purpose of processing: 1) IT systems management, including infrastructure management, business continuity and IT security.

Nature of conferral:

Mandatory - Opposition to processing may result in the Data Controller being unable to perform the contract with the Data Subject/Customer.

Personal data retention period:

Your personal information is kept for the duration of the contractual relationship and after the end of the contractual relationship for as long as necessary to ensure the exercise or defense of rights.

Mode of Treatment:

Processing is carried out with computer tools.

Extra-EU data transfer

Personal data are processed exclusively within the European Union.

Recipients of treatment

• Responsible for Processing: Administrative and Tax Consultancy; Services maintaining ICT systems; Services maintaining Electronic Invoicing; Hosting Services Providers; Technical/Information Management; Services maintaining Privacy Organizational Model (MOP).
• Designated Person Responsible for Processing: Personnel employed by the Data Controller.

Rights of the data subject - complaint to the supervisory authority

In relation to the processing operations described in this Notice, as a data subject you will be able, under the conditions provided by the GDPR, to exercise the rights enshrined in Articles 15 to 22 of the GDPR and, in particular, the following rights:

• Right of access: right to obtain confirmation of whether or not personal data concerning you is being processed and, if so, to obtain access to your personal data;
• Right of rectification: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the supplementation of incomplete personal data;
• Right to erasure (right to be forgotten): right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that the processing is necessary for the performance of a legal obligation or the performance of a task carried out in the public interest or for the establishment, exercise or defense of a right in court;
• Right to restriction of processing (Article 18 GDPR): right to obtain restriction of processing when: (a) the data subject disputes the accuracy of the personal data; (b) the processing is unlawful and the data subject objects to the erasure of the personal data and instead requests that their use be restricted; (c) the personal data are necessary for the establishment, exercise or defense of a legal claim; and (d) the data subject has objected to the processing pending verification as to whether the data controller's legitimate grounds prevail over those of the data subject;
• Right to restrict processing: right to obtain restriction of processing;
• Right to data portability: the right to receive, in a structured, commonly used, machine-readable format, personal data about you and to provide it to another Data Controller;
• Right to object: right to object to the processing of personal data about you on grounds related to your particular situation and in any case to the use of your data for marketing purposes.

Where a processing is based on consent, you will be able to revoke that consent (withdrawal of consent). You will also be able to revoke the consent given at any time and as easily as it was given without affecting the lawfulness of the processing based on the consent given before revocation.

You also have the right not to be subject to a decision based solely on automated processing, including profiling, that has a legal effect or significantly affects you. However, we may make an automated decision if it is necessary for entering into or performing a contract with us, if it is authorized by an Italian or European Union law, or if you have given your consent.

In any case, you have the opportunity to challenge the decision, express your opinions about it, and ask for the intervention of a person who can review it.

You may, at any time, file a complaint with the Data Protection Authority: www.garanteprivacy.it.

The above rights may be exercised against the Holder by contacting the references described above.